GLIDE Exam cheat sheet

Governance allocates decision rights: the board sets strategy and risk appetite, the executive director executes, and management reports through defined lines of accountability.

Separation of duties requires that the body approving a commitment differs from the body authorizing payment and from the body recording the transaction.

Quorum rules govern validity: a vote taken without quorum is void regardless of the margin, so minutes must record attendance and recusal.

Conflict-of-interest policy: a conflicted member discloses, abstains from discussion and vote, and the abstention is minuted; the remaining members decide.

Board effectiveness is assessed on three axes: composition and skills mix, information quality and timeliness, and follow-through on prior decisions.

Delegation is valid only when authority, budget limit, and reporting obligation are written; undocumented delegation leaves the delegator accountable.

Strategic plan hierarchy: mission and vision, then multi-year goals, then annual objectives with owners, measures, and due dates.

Succession exposure is measured by counting key roles with no identified and briefed backup; a single-holder role is a concentration risk.

Risk = likelihood x impact; residual risk = inherent risk after existing controls, and target risk is the appetite threshold the residual must fall below.

Treatment options are exactly four: avoid, reduce (control), transfer (insurance or contract), and accept; acceptance requires documented authority at the right level.

Control types: preventive stops an event, detective finds it after occurrence, corrective limits damage; a control without an owner and test date is not a control.

Three lines model: operations own risk, a risk and compliance function sets framework and challenges, internal audit gives independent assurance.

Compliance obligation register fields: source, requirement, owner, control, evidence, review frequency, and status; an unassigned obligation is a gap.

Risk register scoring needs a defined scale (for example 1-5 for likelihood and 1-5 for impact) applied consistently, or scores are not comparable.

Key risk indicators must be leading, measurable on a fixed cadence, and paired with a threshold that triggers escalation.

Incident process sequence: detect, contain, assess, notify per legal and contractual deadlines, remediate, and update the risk register.

Variance = actual minus budget; variance percentage = variance / budget. Favorable means revenue above or expense below budget.

Budget types: operating (recurring), capital (assets above a capitalization threshold), cash flow (timing), and forecast (revised expectations).

Break-even volume = fixed costs / (price per unit - variable cost per unit); contribution margin per unit is price minus variable cost.

Full cost of a service includes direct costs, allocated indirect overhead, and the cost of capital where the funder requires it.

Fund accounting restricts use: restricted balances cannot cover unrestricted deficits, and inter-fund transfers need documented authority.

Reserve target is stated in months of operating expense; reserve ratio = unrestricted reserves / monthly operating expense.

Zero-based budgeting rebuilds each line from a stated service level; incremental budgeting adjusts the prior base, which perpetuates historical allocations.

Segregation in payment: requester, approver, and disburser are distinct roles, and bank signatories are reviewed on a fixed cycle.

Headcount gap = approved positions minus filled positions; vacancy rate = vacancies / approved positions.

Cost per hire = total recruiting cost / number of hires; time to fill = days from requisition approval to offer acceptance.

Turnover rate = separations in period / average headcount; voluntary and involuntary must be reported separately or the figure misleads.

Span of control is direct reports per manager; a wide span needs more standardized process, a narrow span adds management layers and cost.

Competency model links each role to required knowledge, skills, and behaviors, and each competency to a verifiable assessment method.

Performance cycle: objective setting, mid-cycle check, year-end rating against evidence, calibration across managers, then development plan.

Total rewards = base pay + variable pay + benefits + employer contributions; compare to market using a defined percentile (for example median).

Succession and development: identify critical roles, rate incumbent risk and readiness of successors, and fund development against the gap.

Little's Law: average work in process = arrival rate x average time in system; use it to size queues and staffing.

Capacity utilization = actual output / maximum capacity; sustained utilization near the ceiling increases wait times non-linearly.

Service level is defined by a measurable target (for example percentage of requests resolved within a stated number of days) plus the measurement method.

Process mapping distinguishes value-adding steps from handoffs and waiting; cycle time includes queue time, processing time alone understates it.

Standard work specifies the sequence, time, and quality check for a task; deviation from standard is the trigger for root cause analysis.

Root cause tools: five whys, fishbone (people, process, equipment, materials, environment, measurement), and Pareto ranking by frequency or cost.

Continuous improvement loop: define the problem with data, measure baseline, test a change, compare result to baseline, then standardize or revert.

Continuity planning requires a documented recovery time objective per critical service and a tested alternate arrangement.

Data governance assigns ownership: a data owner is accountable for quality and access decisions, a steward executes definitions and checks.

Data quality dimensions: completeness, accuracy, timeliness, consistency, uniqueness, and validity; each needs a defined test and threshold.

Access control principle of least privilege plus role-based assignment; access reviews are periodic and evidenced, and joiner-mover-leaver steps are mandatory.

Backup rule: at least three copies, on two media types, with one off-site or offline; restoration must be tested on a schedule, not assumed.

Recovery point objective is tolerated data loss in time; recovery time objective is tolerated downtime. They are separate commitments.

Privacy obligations: collect the minimum necessary, state the purpose, limit retention, and honor access and correction requests within legal deadlines.

System change control requires a documented request, impact and risk assessment, approval, test evidence, and a rollback plan before release.

Incident severity tiers drive response: each tier defines who is notified, how fast, and what evidence is preserved for later review.